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DETAILED ACTION 

1 . This Office action is responsive to communication filed on 1 2/22/1 0. Claims 1 - 
30, and 67-133 are pending. Claims 1-17, 19-30, and 67-133 are rejected. 

Information Disclosure Statement 

2. The information disclosure statement filed 1 0/06/1 0 fails to comply with 37 
CFR 1 .97(d) because it lacks a statement as specified in 37 CFR 1 .97(e). It has been 
placed in the application file, but the information referred to therein has not been 
considered. 

Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, macliine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

4. Claims 70-133 are rejected under 35 U.S.C. 101 because the claimed invention 

is directed to non-statutory subject matter. 

5. Claims 70-101 are drawn to a "computer program product embodied on a 
tangible computer readable medium". The specification is silent regarding the meaning 
of the term "tangible computer readable medium". Thus, applying the broadest 
reasonable interpretation in light of the specification and taking into account the 
meaning of the words in their ordinary usage as they would be understood by one of 
ordinary skill in the art (MPEP § 21 1 1 ), the claim as a whole covers both transitory and 
non-transitory media. A computer program product is considered to be functional 
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descriptive material, which is statutory only if recorded on non-transitory computer- 
readable medium. MPEP 2106.01. 



Claim Rejections - 35 USC § 103 

6. The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

7. Claims 1 -3, 5,11-15,1 7, 22-26, 28, 67-72, 74, 80-84, 86, 91 -95, 97, 99-1 04, 1 06, 
1 07, 1 1 2-1 16,118,1 23-1 27, 1 29, and 1 31 -1 33 are rejected under 35 U.S.C. 1 03(a) as 
being unpatentable over U.S. Pat. No. 6,460,050 ("Pace"), and further in view of U.S. 
Pub. No. 2002/0199095 ("Bandini"), U.S. Pub. No. 2004/0221062 ("Starbuck"), and U.S. 
Pub. No. 2003/0120647 ("Aiken"). 

8. Bandini, Starbuck and Aiken are intervening references. After reviewing 
applicant's priority documents, it has been determined that the priority documents do not 
support the relevant claim limitations with a sufficient date to overcome the intervening 
references. 

9. Regarding claims 1 , 70, and 102, Pace teaches a method, a computer program 
product implementing said method, and a system implementing said method, said 
method comprising: 
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receiving a plurality of e-mail messages (Fig. 2, Col. 3, lines 32-58); and 
generating hash values, as generated hash values, based a plurality of portions 
of each message body of the plurality of e-mail messages ('digital ID... may be.. multiple 
hashes', 'hash may be of.. .portions of the body', Col. 4, lines 1-14). 

Pace fails to teach counting a number of the generated hash values 
corresponding to the message body associated with one of the plurality of e-mail 
messages that match the hash values corresponding to the message body associated 
with prior e-mail messages; and utilizing a settable score-related threshold, determining 
that one of the plurality of e-mail messages is a potentially unwanted e-mail message, 
the determination being based, at least in part, on the number of generated hash values 
corresponding to the message body associated with one of the e-mail messages that 
match the hash values corresponding to the message body associated with the prior 
email messages. 

Bandini teaches keeping a running comparison score ('running comparison 
score', H [0023]) of the generated hash values corresponding to the message body 
('hash computation result based on the message body, or portions of the message 
body', H [0025]) associated with one of the plurality of e-mail messages that match the 
hash values corresponding to the message body associated with prior e-mail messages 
(f [0038]); and utilizing a settable score-related threshold (f [0021]), determining that 
one of the plurality of e-mail messages is a potentially unwanted e-mail message, the 
determination being based, at least in part, on the number of generated hash values 
corresponding to the message body associated with one of the e-mail messages that 
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match the hash values corresponding to the message body associated with the prior 
email messages (Fig. 3). It would have been obvious to one of ordinary skill in the art at 
the time of applicant's invention to performing the steps of counting, and determining as 
taught by Bandini in order to effectively reduce the amount of SPAM received by a user. 

Pace-Bandlnl fails to teach processing e-mail messages by removing HTML 
comments and HTML tags from the e-mail messages, and performing hashing based on 
the processed e-mail messages. Starbuck teaches processing e-mail messages by 
removing HTML comments and HTML tags from the e-mail messages, and performing 
hashing based on the processed e-mail messages (1| [0007], [0009], [0048]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's invention to 
removing HTML from e-mail messages prior to hashing as taught by Starbuck in order 
to prevent HTML comments from circumventing SPAM filters. 

Pace-Bandini-Starbuck fails to teach counting a number of hashes that match. 
Aiken teaches determining how well something matches based on whether the number 
of hashes that match exceed a threshold (f [0077]). It would have been obvious to one 
of ordinary skill in the art at the time of applicant's invention to determine how well 
something matches as taught by Aiken in order to efficiently provide better matches. 

1 0. Regarding claim 2, 71 , and 1 03, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including performing a plurality of hashes on a plurality of variable-sized blocks of a 
main text of the plurality of e-mail messages (Pace: 'all of the body or portions of the 
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body', Col. 4, lines 1-14). Since the main texts of messages are not all the same length, 
the block (i.e., body) is variably-sized. 

1 1 . Regarding claim 3, 72, and 1 04, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including performing a plurality of hashes on a plurality of fixed-sized blocks of a subject 
line (Pace: 'some number of characters of the subject line', Col. 4, lines 1-14), but fails 
to teach doing so for fixed-sized blocks of the main text. 

In KSR Int'l. Co. v. Teleflex Inc. , the Court recognized that "if a technique has 
been used to improve one device, and a person of ordinary skill In the art would 
recognize that it would improve similar devices in the same way, using the technique is 
obvious unless its actual application is beyond his or her skill". 127 S.Ct 1727, 1740 
(2007). In the instant case, one of ordinary skill would recognize that SPAM messages 
are modified slightly in order to avoid exact matching by SPAM filters. It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention to 
apply the technique taught in Pace to fixed-sized blocks of main text in order to make it 
harder for SPAM senders to circumvent SPAM filters 

1 2. Regarding claim 5, 74, andl 06, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including performing a plurality of hashes on a main text of the plurality of e-mail 
messages using a same hash function (Pace: 'MD5', Col. 4, lines 1-14). 
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1 3. Regarding claim 1 1 , 80, and 1 1 2, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including comparing the generated hash values to hash values corresponding to known 
unwanted e-mails (Pace: Col. 6, lines 1-18). 

1 4. Regarding claim 12,81, and 1 1 3, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claim 1 1 , 80, and 1 12 above, 

including that known unwanted e-mails include at least one of e-mails containing a 
virus, e-mails containing a worm, and unsolicited commercial e-mails (Pace: 'spam', 
Col. 6, lines 1-18). 

15. Regarding claims 13, 82, and 114, Pace teaches the invention substantially as 
claimed and described in claims 1 , 70, and 102 above, including hashing at least one of 
a main text and an attachment to generate one or more first hash values (Pace: 'all of 
the body or portions of the body'. Col. 4, lines 1 -14), and hashing a concatenation of first 
and second header fields to generate a second hash value (Pace: Col. 4, lines 1-14; 
Bandini: para. [0026]). 

1 6. Regarding claims 1 4, 83, and 1 1 5, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 13, 82, and 114 above, 
including a From header field and a To header field (Bandini: para. [0026]). 
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1 7. Regarding claims 1 5, 84, and 1 1 6, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 13, 82, and 114 above, 
including generating a first and second suspicion count (Bandini: Fig. 3, step 66 
compares various message attributes to data in database (i.e., previous hash values)). 

1 8. Regarding claim 1 7, 86, and 1 1 8, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including taking remedial action when the one of the plurality of e-mail messages is a 
potentially unwanted e-mail message, the taking remedial action including at least one 
of: discarding the one of the plurality of e-mail messages, bouncing the one of the 
plurality of e-mail messages, marking the one of the plurality of e-mail messages with a 
warning, subjecting the one of the plurality of e-mail messages to a virus or worm 
detection process, creating a notification message, and generating a suspicion score for 
the one of the plurality of e-mail messages and using the suspicion score to identify 
further processing for the one of the plurality of e-mail messages (Pace: 'subject line 
may be appended to indicate that the e-mail is "spam", Col. 5, lines 41-54). 

1 9. Regarding claim 22, 91 , and 1 23, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including comparing the generated hash values to known legitimate mailing lists; and 
passing the plurality of e-mail messages without further examination when the 
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generated hash values match one or more of the known legitimate mailing lists (Pace: 
'exceptions', Col. 6, lines 18-34). 

20. Regarding claim 23, 92, and 124, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claim 22, 91 , and 123 above, 
including determining whether the plurality of e-mail messages originated from the 
known legitimate mailing lists (Pace: Col. 6, lines 18-34). 

21 . Regarding claims 24, 93, and 125, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including hashing a main text to generate a first hash value (Pace: 'all of the body or 
portions of the body'. Col. 4, lines 1-14), and hashing sender-related header fields 
(Bandini: 'sender address', para. [0026]). 

22. Regarding claims 25, 94, and 126, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 24, 93, and 125 above, 
including that a sender-related header fields include at least one of a From header field, 
a Sender header field, and a Reply-To header field (Bandini: para. [0026]). 

23. Regarding claims 26, 95, and 127, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 24, 93, and 125 above. 
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including generating a first and second suspicion count (Bandini: Fig. 3, step 66 
compares various message attributes to data in database (i.e., previous liasli values)). 

24. Regarding claim 28, 97, and 129, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including hashing a main text of the plurality of e-mail messages to generate a main text 
hash (Pace: 'all of the body or portions of the body', Col. 4, lines 1-14), and hashing at 
least one header field of the plurality of e-mail messages to generate at least one 
header hash (Pace: 'header', Col. 4, lines 1-14). 

25. Regarding claims 67, 99, and 1 31 , Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including processing e-mail messages before generating hash values (Starbuck: % 
[0009]). 

26. Regarding claims 68, 100, and 132, Pace-Bandini-Starbuck-Aiken teaches the 

invention substantially as claimed and described in claims 1 , 70, and 102 above, 
including processing e-mail messages in parallel with generating hash values (Starbuck: 
If [0009], 'concurrently', H [0025]). 

27. Regarding claims 69, 101 , and 133, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above. 
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including that the portions of each message body of the plurality of e-mail messages 
that have been processed includes blocks (Pace: 'portions of the body', Col. 4, lines 1- 
14). 

28. Claims 4, 73, and 1 05 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Pace-Bandini-Starbuck-Aiken as applied to claims 1, 70, and 102 
above, and further in view of U.S. Pat. No. 6,169,969 ("Cohen"). 

29. Regarding claims 4, 73, and 105, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, 102 above, but fails to 
teach performing a plurality of hashes on a main text of the plurality of e-mail messages 
using a plurality of different hash functions. 

Cohen discloses employing multiple hash functions (Col. 2, lines 1-21) 
(describing Bloom). It would have been obvious to one of ordinary skill in the art at the 
time of applicant's invention to employ multiple hash functions as disclosed in Cohen in 
order to improve false alarm rates. 

30. Claims 6, 75, and 107 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pace-Bandini-Starbuck-Aiken as applied to claims 1, 70, and 102 
above, and further in view of U.S. Pub. No. 2003/0167402 ("Stolfo"), and U.S. 
2002/0152399 ("Smith"). 
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31 . Stolfo and Smith are intervening references that qualify as prior art because the 
Office was unable to find in applicant's priority documents support for the claim 
limitations for which Stolfo and Smith are relied upon. 

32. Regarding claims 6, 75, and 107, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, but 
fails to teach performing hashes on attachments. 

Stolfo teaches performing hashes on attachments ('MD5', para. [0045]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's invention 
to perform hashes on attachments as taught by Stolfo in order to detect malicious 
attachments. 

Pace-Bandini-Starbuck-Aiken-Stolfo fails to teach attempting to decompress an 
attachment prior to hashing. Smith teaches decompressing an attachment prior to 
determining whether the attachment contains an exploit (Fig. 6; para. [0071]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's invention 
to decompress an attachment prior to scanning as taught by Smith in order to find 
hidden exploits in an attachment. 

33. Claims 7, 8, 1 0, 76, 77, 79, 1 08, 1 09, and 1 1 1 are rejected under 35 

U.S.C. 103(a) as being unpatentable over Pace-Bandini-Starbuck-Aiken as applied to 
claims 1 , 70, and 102 above, and further in view of Stolfo. 
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34. Regarding claims 7, 76, and 108, Pace-Bandini-Starbuck-Aiken teaclies tine 
invention substantially as claimed and described in claims 1 , 70, and 1 02 above, 
including performing a plurality of hashes on a plurality of variable-sized blocks of 
information (Pace: Col. 4, lines 1 -14), but fails to teach performing hashes on 

attachments. 

Stolfo teaches performing hashes on attachments (para. [0045]). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention to 
perform hashes on attachments as taught by Stolfo in order to detect malicious 
attachments. 

35. Regarding claims 8, 77, and 109, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, 

including performing a plurality of hashes on a plurality of fixed-sized blocks of 
information (Pace: Col. 4, lines 1-14), but fails to teach performing hashes on 
attachments. 

Stolfo teaches performing hashes on attachments (para. [0045]). It would have 

been obvious to one of ordinary skill in the art at the time of applicant's invention to 
perform hashes on attachments as taught by Stolfo in order to detect malicious 
attachments. 



Application/Control Number: 10/654,771 Page 14 

Art Unit: 2452 

36. Regarding claims 1 0, 79, and 111, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70 and 102 above, but fails 
to teach performing hashes on attachments. 

Stolfo teaches performing hashes on attachments using a single hash function 
('MD5', para. [0045]). It would have been obvious to one of ordinary skill in the art at the 
time of applicant's invention to perform hashes on attachments as taught by Stolfo in 
order to detect malicious attachments. 

37. Claims 9, 78, and 11 0 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Pace-Bandini-Starbuck-Aiken as applied to claims 1, 70 and 102 
above, and further in view of Stolfo and Cohen. 

38. Regarding claims 9, 78, and 110, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, but 
fails to teach performing hashes on attachments. 

Stolfo teaches performing hashes on attachments (para. [0045]). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention to 
perform hashes on attachments as taught by Stolfo in order to detect malicious 
attachments. 

Pace-Bandini-Starbuck-Aiken-Stolfo fails to teach performing a plurality of 
hashes using a plurality of different hash functions. Cohen discloses employing multiple 
hash functions (Col. 2, lines 1-21) (describing Bloom). It would have been obvious to 
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one of ordinary skill in the art at the time of applicant's invention to employ multiple hash 
functions as disclosed in Cohen in order to improve false alarm rates. 

39. Claims 1 6, 27, 85, 96, 1 1 7, and 1 28 are rejected under 35 U.S.C. 1 03(a) as 
being unpatentable over Pace-Bandini-Starbuck-Aiken as applied to claims 15, 26, 84, 
95, 116, and 127 above, and further in view of U.S. Pat. No. 6,985,923 ("Bates"). 

40. Regarding claims 16, 27, 85, 96, 117, and 128, Pace-Bandini-Starbuck-Aiken 
teaches the invention substantially as claimed and described in claims 15, 26, 84, 95, 
116, and 127 above, but fails to teach determining that an email message is potentially 
unwanted when the main text matches a substantially higher number of emails than the 
header hash. In other words, an email is unwanted when the same message is 
received from different addresses. 

Bates teaches determining that a message is unwanted when the same message 
is received from different senders (Col. 1 , lines 22-30). It would have been obvious to 
one of ordinary skill in the art at the time of applicant's invention to determine messages 
to be unwanted when the same message is received from different senders as taught 
by Bates in order to avoid duplicate messages. 

41 . Claims 1 9-21 , 88-90, and 1 20-1 22 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Pace-Bandini-Starbuck-Aiken as applied to claims 1 , 70, and 1 02 
above, and further in view of Schiavone. 
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42. Regarding claims 19, 88, and 120, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 1 , 70, and 102 above, but 
fails to teach generating and comparing hash values as a message is being received. 

Schiavone teaches performing hashing in real-time as the message is being 
received (para. [0026]). It would have been obvious to one of ordinary skill in the art at 
the time of applicant's invention to perform hashing in real-time as taught by Schiavone 
in order to bouncing messages in real-time. 

43. Regarding claims 20, 89, and 121 , Pace-Bandini-Starbuck-Aiken-Schiavone 
teaches the invention substantially as claimed and described in claims 19, 88, and 120, 
including: 

generating a suspicion score for the plurality of e-mail messages based on a 
result of the counting of the number of the generated hash values corresponding to the 
message body associated with the plurality of e-mail messages that match the hash 
values corresponding to the message body associated with prior e-mail messages 
(Bandini: Fig. 3; para. [0023]); and 

taking remedial action when the suspicion score of an e-mail message of the 
plurality of e-mail messages is above a threshold (Bandini: Fig. 3; para. [0023]), the 
taking remedial action including rejecting the e-mail message (Bandini: Fig. 2, Step 60). 
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44. Regarding claims 21, 90, and 120, Pace-Bandini-Starbuck-Aiken-Scliiavone 
teaches the invention substantially as claimed and described in claims 20, 89, and 121 , 
including that rejecting occurs before the e-mail message is completely received 
(Schiavone: para. [0026]). 

45. Claims 29, 98, and 1 30 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Pace-Bandini-Starbuck-Aiken as applied to claims 28, 97, and 129 
above, and further in view of Bates. 

46. Regarding claims 29, 98, and 130, Pace-Bandini-Starbuck-Aiken teaches the 
invention substantially as claimed and described in claims 28, 97, and 129 above, but 
fails to teach determining that an email message is potentially unwanted when the main 
text hash matches a substantially higher number of emails than the header hash. In 
other words, an email is unwanted when the same message is received from different 
addresses. 

Bates teaches determining that a message is unwanted when the same message 

is received from different senders (Col. 1 , lines 22-30). It would have been obvious to 
one of ordinary skill in the art at the time of applicant's invention to determine messages 
to be unwanted when the same message is received from different senders as taught 
by Bates in order to avoid duplicate messages. 
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Allowable Subject Matter 

47. Claim 1 8 is objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the 
base claim and any intervening claims. 

48. The following is a statement of reasons for the indication of allowable subject 
matter: The prior art of record fails to teach deleting the e-mail with the highest 
suspicion score (e.g., most likely to be SPAM) when an incoming email exceeds a mail 
quota. 

Response to Arguments 

49. Applicant's arguments filed 1 2/22/1 0 have been fully considered but they are not 
persuasive. 

a. Applicant argues that claims 70-1 01 comply are directed towards statutory 
subject matter. Remarks p. 24. Applicant cites f [0035] in support. Id. Applicant's 
argument is not persuasive because the cited portion provides only examples of 
what a computer readable medium may be. It does not explicitly exclude 
transitory media from the term "computer-readable medium". 

b. Applicant argues that Starbuck fails to teach that stripping HTML 
comments and tags occur in parallel to the generation of hash values. Remarks 
p. 29. Applicant's argument rests on the fact that Starbuck fails to teach 
generating hash values. Id. In response to applicant's arguments against the 
references individually, one cannot show nonobviousness by attacking 



Application/Control Number: 10/654,771 Page 19 

Art Unit: 2452 

references individually where the rejections are based on combinations of 
references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re 
Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). As shown above, 
Bandini teaches generating hash values. Starbuck teaches that the steps may be 
performed concurrently (i.e., in parallel), f [0025]. It would have been obvious to 
one of ordinary skill in the art at the time of applicant's invention to perform the 
step of generating hash values as taught by Bandini in parallel with the steps of 
Starbuck. 

c. Applicant's remaining arguments are moot in view of the new ground(s) of 
rejection presented above. 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JULIAN CHANG whose telephone number is (571)272- 
8631 . The examiner can normally be reached on Monday thru Friday 9AM to 5PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Thu Nguyen can be reached on (571) 272-6967. The fax phone number for 
the organization where this application or proceeding is assigned is 571 -273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/J. C./ 

Examiner, Art Unit 2452 
/THU NGUYEN/ 

Supervisory Patent Examiner, Art Unit 2452 



